minor changes

all data returned is wrapped in JSON
errors are returned as HTTP errors
/token endpoint accepts POST params now
all private API's check for access_token header << maybe change to
"authorize"?